Suspicious Hypervisor-protected Code Integrity (HVCI) Related Registry Manipulation Through CommandLine (via process_creation)

This rule detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load hostile or unsigned drivers, that can be leveraged to escalate privileges, maintain persistence, or evade security mechanisms.